The roles have moved to the frontend bundle for now, which makes
them work for all API users, not jsut the ones that have a Person object
associated.

In the future we also don't want to expose the roles directly but
add one more layer, some kind of API "capabilities".